Fingerprint, the industry leader in device intelligence, today announced expanded bot detection capabilities that identify traffic inferred to be undeclared AI agents, including Meta's Muse, Spear Street's Instinct and xAI's Grok Bot. As more AI agents operate without identifying themselves, Fingerprint provides browser-level visibility to recognize previously unidentified automated traffic, distinguish it from legitimate human activity and enable businesses to determine which interactions to allow, limit or block.
More than half of all web traffic in 2026 is no longer human, which is largely due to AI agents acting on behalf of consumers or enterprises. While industry standards such as Web Bot Auth were designed to let AI agents cryptographically prove their identity, a growing wave of prominent agents are choosing to operate undeclared or are actively shifting away from signed traffic.
Muse provides no verifiable identity, alters its browser fingerprint and suppresses the standard automation flags that traditional bot detection tools rely on. Fingerprint's research team shipped detection for traffic inferred to be Muse roughly two weeks after the agent was announced, and subsequently identified Muse activity on a major bank's login flows that the bank's other security vendors failed to flag. Instinct logs into websites using human credentials, including by requesting multi-factor authentication codes from the user via SMS, without signing its traffic via Web Bot Auth. In one high-profile case, Instinct pinged restaurant reservation platform Resy hundreds of times every hour on behalf of a user, resulting in account deactivation. Grok Bot can sign in to websites, work through inboxes, and finish multistep tasks for real users. It used to announce itself on arrival by signing its requests with Web Bot Auth, but around October 9, 2026, it stopped.
"More AI agents are visiting websites without disclosing their identity, and some that used to, like Grok Bot, have stopped," said Dan Pinto, CEO and Co-founder of Fingerprint. "That lack of transparency is already a widespread issue: Fingerprint's recent report found that 79% of financial institutions have caught a malicious bot or scraper posing as an AI assistant. Fingerprint can identify traffic inferred to be Muse, Instinct and Grok Bot without any assistance from their developers, giving enterprises the ability to uncover previously undetected AI agent activity and make informed decisions about which traffic to allow, limit or block."
Legacy bot management tools force businesses into either blocking all automated traffic, which risks turning away paying customers' AI assistants, or allowing unrecognized automation, which exposes login flows and payment methods to abuse. Fingerprint checks the network edge and/or the browser to reveal what is behind every visit: a human user, a known automated bot, an AI agent that cryptographically proves who it is, an undeclared AI agent that hides its identity or a spoofed bot masking its identity.
With Fingerprint's Bot Detection Smart Signal, security and fraud teams can read changing signals identifying visitors and surfacing intent cues even as device and browser signals evolve, move beyond "bot or not" distinguishing malicious automation and human fraud from trusted returning visitors, verified AI agents and undeclared AI agents with labels for specific agents along with high, medium or low confidence tiers, and reveal full network and device context combining agent inference with granular telemetry including IP address, ASN, ASN type and whether request came from data center.
Detection for Muse, Instinct and Grok Bot is available today through Fingerprint Bot Detection via the Fingerprint JS Agent, Server API, Rules Engine and the Fingerprint MCP Server.
About Fingerprint
Fingerprint detects the intent of human and agentic visitors. Our device intelligence platform identifies over 1 billion unique devices every month and processes hundreds of signals to help fraud teams distinguish trusted visitors from bad actors at speed and scale. Over 6,000 companies, including innovators like Plaid, Booking.com, Dropbox, Trustpilot and Checkout.com, use Fingerprint every day to recognize high-risk activity in real time, prevent fraud attacks and deliver frictionless user experiences.
